Vertical Weather Privacy Notice

Version 1, effective 25 September 2026

This notice explains what personal data the Vertical Weather API, dashboard, website and MCP server (the “Service”) process, why, and your rights under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Stephen Filios, Germany. The postal address is in the Impressum. Email: support@verticalweather.com

We have not appointed a data protection officer because we are not required to.

2. What we process, and why

Website (verticalweather.com)

The documentation website currently uses no cookies, analytics or tracking scripts. Our hosting provider processes your IP address and technical request data (such as browser type and the page requested) to deliver pages and protect against abuse, and may keep short-lived server logs. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

Your account and sign-in

Sign-in is handled by Clerk. When you sign up, Clerk processes the data you provide or authorise, such as your email address, name and, if you sign in with Google or Apple, the profile data that provider shares. Clerk uses cookies and similar technology that are necessary for sign-in.

We do not store your email address or name in our own database. We store:

• an internal account ID linked to Clerk’s identifier for you;
• the date the account was created and whether it is disabled.

Legal basis: providing the Service you signed up for (Art. 6(1)(b) GDPR).

API keys

For each key we store its name (which you choose), a short visible prefix, its creation and revocation times, and a one-way cryptographic hash of the key. We never store the key itself, so we cannot show it to you again. Legal basis: Art. 6(1)(b) GDPR.

Using the API

• Location and time in requests. We use the coordinates, time and heights you send to compute your profile. We don’t currently keep a record of individual requests linked to you or your account.
• Forecast cache. To avoid downloading the same data repeatedly, we cache weather model data for requested locations for up to 24 hours. Cache entries are shared between all users and do not record who asked for them.
• Usage counters. We count requests per account (or per key) to enforce usage limits. Short-term counters expire within minutes; daily counters are kept for up to eight days.
• Technical logs. Our servers and hosting provider may record technical data, such as IP addresses and error messages, to operate and secure the Service. Our hosting provider for the API (Fly.io) currently deletes these logs automatically after 7 days. We keep them longer only if we need them to investigate a specific security incident.

Legal basis: providing the Service (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse and keeping the Service running (Art. 6(1)(f) GDPR).

Emails to support

If you email support@verticalweather.com, we process your message and contact details to answer it, and keep them as long as needed for that purpose. Legal basis: Art. 6(1)(b) or (f) GDPR.

3. Service providers

We use these providers to run the Service. They process data on our behalf under data processing agreements:

Provider	Purpose	Location
Fly.io, Inc.	Hosting the API and its database	USA (Virginia)
Clerk, Inc.	Sign-in and account identity	USA
Netlify, Inc.	Hosting the documentation website	USA / global CDN
Cloudflare, Inc.	Domain name service and email forwarding	USA / global

Weather data is downloaded from NOAA. We do not send your personal data to NOAA.

4. Transfers outside the EU

Some providers are based in the United States. Where a provider is certified under the EU-U.S. Data Privacy Framework, transfers rely on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise they rely on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

5. How long we keep data

• Account and key records: until you delete your account. You can do this at any time in the dashboard (“Delete account”); it removes your account and all API keys from our live systems immediately and asks Clerk to delete your sign-in profile. Deleting your profile directly with Clerk has the same effect. So that deleting and re-creating an account can’t be used to reset usage limits, we keep a one-way hash of your sign-in identifier, linked to your former internal account ID, for up to eight days after deletion.
• Usage counters, cache and logs: as described in section 2.
• Backups: our hosting provider takes daily snapshots of the API’s storage and keeps each one for 5 days, so deleted data can remain in a snapshot for up to 5 days before it is removed automatically.
• We keep data longer only where the law requires it (for example, records of payments, once paid plans exist).

6. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to data portability (Art. 15–21 GDPR). Where we rely on legitimate interests, you can object at any time on grounds relating to your situation. Contact support@verticalweather.com.

You may complain to a data protection supervisory authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany (https://www.lda.brandenburg.de).

You are not required to provide personal data, but without an account we cannot issue API keys.

7. Changes

This notice describes the Service as it works today. If we start processing new kinds of personal data (for example for billing or notification emails), we will update this notice, with a new version number and date, before we do.